Bypassing Antivirus with Ten Lines of Code
attactics.org
Bypassing Antivirus with Ten Lines of Code
1–10 of 100 posts
Re: Bypassing Antivirus with Ten Lines of Code
#2Laughable. Ages ago I realised you could just take an exploit, base64 the contents of the binary code, save it in a string. You could then unbase64 it and execute the binary in memory. Nothing seemed to catch it.
Re: Bypassing Antivirus with Ten Lines of Code
#3Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed?
Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.
Re: Bypassing Antivirus with Ten Lines of Code
#4It's initially worrying, but it makes a certain amount of sense when you think that an antivirus is a blacklist (of known vulnerabilities), not a whitelist.
Somewhat related: http://security.stackexchange.com/a/117312
Re: Bypassing Antivirus with Ten Lines of Code
#5Laughable. Ages ago I realised you could just take an exploit, base64 the contents of the binary code, save it in a string. You could then unbase64 it and execute the binary in memory. Nothing seemed to catch it.
You'd still need a decoding stub which can be fingerprinted. An XOR "decoder" is far smaller in shellcode and can be custom written in asm to reduce time-to-first-signature.
Re: Bypassing Antivirus with Ten Lines of Code
#6It'll work until a virus scanner company distributes a virus definition file containing a signature of your offending code.
Re: Bypassing Antivirus with Ten Lines of Code
#7Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.
No, this is not surprising at all.
It's impossible to determine whether software is malicious or not (Rice's theorem).
Antivirus software only reliably detects code that is identical to known malicious software.
Re: Bypassing Antivirus with Ten Lines of Code
#8Re: Bypassing Antivirus with Ten Lines of Code
#9Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.
> Is this an oversight of the AV software companies?
No, this is a principle limitation of any AV software that is based on blacklisting.
> Did no one come up with this before?
Of course other people came up with similar ideas before.
> Should I be shocked?
If and only if you had trust in your AV software before.
Re: Bypassing Antivirus with Ten Lines of Code
#10You're not secure until you whitelist. And even that's not a guarantee; it's a necessary but sufficient condition. But systems which do not run signed, whitelisted code from boot time forward are as good as pwnt.